From cb946cd133f7958da4a62a102cf560de4857b2dc Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Sun, 12 Jul 2026 08:51:54 +0900 Subject: [PATCH] ksmbd: validate file ids for query network interface info FSCTL_QUERY_NETWORK_INTERFACE_INFO is not tied to an open file handle. Clients send SMB2_NO_FID for both file id fields when issuing this request. Reject requests that provide any other file id before checking the output buffer size. This returns STATUS_INVALID_PARAMETER for invalid file ids instead of treating the request as valid or reporting STATUS_BUFFER_TOO_SMALL for a small output buffer. Signed-off-by: Namjae Jeon --- fs/smb/server/smb2pdu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 96fbf91a9cad..91abbb90f262 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -9673,6 +9673,12 @@ int smb2_ioctl(struct ksmbd_work *work) rsp->VolatileFileId = SMB2_NO_FID; break; case FSCTL_QUERY_NETWORK_INTERFACE_INFO: + if (req->PersistentFileId != SMB2_NO_FID || + req->VolatileFileId != SMB2_NO_FID) { + ret = -EINVAL; + goto out; + } + ret = fsctl_query_iface_info_ioctl(conn, rsp, out_buf_len); if (ret < 0) goto out;